# AI Data Sovereignty Risk Assessment: Where Does Your Data Actually Go? > Source: https://netray.co/tools/ai-data-sovereignty-risk-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Score your organization across eight dimensions of AI data sovereignty risk, from inference location and encryption key custody to subprocessor visibility and audit readiness. ## Category on-prem-ai ## Tool **Kind:** assessment **Questions:** #### Where does inference actually execute for your most sensitive AI workloads? **Help:** Marketing pages describe a region. Contracts and infrastructure diagrams describe reality. **Options:** ##### Entirely on infrastructure we own or directly control inside our jurisdiction **Score:** 3 ##### A contracted private cloud instance in-region with documented residency terms **Score:** 2 ##### A public cloud AI API with a region pinned but vendor-managed **Score:** 1 ##### A public cloud AI API with no enforced region guarantee **Score:** 0 #### Do you know which countries your AI vendor's subprocessors operate in? **Options:** ##### Yes, full subprocessor list reviewed and contractually restricted **Score:** 3 ##### Yes, subprocessor list reviewed but not restricted **Score:** 2 ##### We have seen a list at some point but never reviewed it **Score:** 1 ##### No visibility into subprocessors at all **Score:** 0 #### Who holds the encryption keys protecting AI data at rest and in transit? **Options:** ##### We hold all keys ourselves, in an HSM or on-prem KMS **Score:** 3 ##### Customer-managed keys inside the vendor's cloud KMS **Score:** 2 ##### Vendor-managed keys with audit logging we can review **Score:** 1 ##### Vendor-managed keys with no visibility into key operations **Score:** 0 #### Can prompts or documents sent to an AI system physically leave your country? **Options:** ##### Never; the system is air-gapped or restricted to in-country infrastructure **Score:** 3 ##### Only to a contractually restricted, named region **Score:** 2 ##### Possible under the vendor's terms but not actively tracked **Score:** 1 ##### Yes, routinely, to whichever region has capacity that day **Score:** 0 #### Do you have a documented data flow map for every AI system in production? **Options:** ##### Yes, maintained and reviewed on a quarterly cadence **Score:** 3 ##### Yes, but it is stale and no longer matches production **Score:** 2 ##### Informal, mostly in one engineer's head **Score:** 1 ##### No data flow map exists for our AI systems **Score:** 0 #### What happens to prompts and outputs after a request completes? **Options:** ##### Immediately discarded, with zero retention verified contractually **Score:** 3 ##### Retained under a defined, short, documented retention window **Score:** 2 ##### Retained indefinitely for model improvement unless we opted out **Score:** 1 ##### Unknown; retention is not addressed anywhere in the contract **Score:** 0 #### Do your customer or regulatory contracts include data flow-down requirements, and do you apply them to AI vendors? **Help:** ITAR, GDPR, and customer-specific data handling clauses apply to an AI vendor exactly as they apply to any other subcontractor. **Options:** ##### Yes, every AI vendor is formally assessed against flow-down requirements before onboarding **Score:** 3 ##### Yes, requirements exist but AI vendors have not been separately assessed **Score:** 2 ##### We are aware of the requirements but do not apply them systematically **Score:** 1 ##### Flow-down requirements are not tracked at all **Score:** 0 #### Can you produce evidence of data residency on demand for an auditor or customer? **Options:** ##### Yes, automated evidence is available within a day **Score:** 3 ##### Yes, with roughly a week of manual reconstruction **Score:** 2 ##### We could probably reconstruct it eventually, with effort **Score:** 1 ##### No, we would be guessing **Score:** 0 **Bands:** #### Sovereignty blind spot: assume the worst until proven otherwise **Min:** 0 **Max:** 29 **Verdict:** You cannot currently demonstrate where AI data goes, who can reach it, or who holds the keys protecting it. For a regulated manufacturer this is not a paperwork gap, it is an active contractual and export-control exposure that an auditor or a lost customer contract will find before you do. **Recommendations:** - Build a data flow map for every AI system in production before adding a single new use case. - Identify which AI workloads touch export-controlled, customer-confidential, or personal data and freeze new onboarding for those workloads. - Request and review the subprocessor list and retention terms for every AI vendor currently in use. - Move your highest-sensitivity workload to infrastructure you control while you fix the rest. - Assign a single named owner for AI data sovereignty; today it is likely nobody's job. #### Partial visibility, real exposure **Min:** 30 **Max:** 54 **Verdict:** You have some controls in place but they are inconsistent across systems, and you would struggle to produce evidence quickly if a customer or assessor asked for it today. The gaps are usually key custody and subprocessor visibility, which are the two areas contracts and marketing pages describe least accurately. **Recommendations:** - Move from vendor-managed to customer-managed encryption keys for any workload touching sensitive data. - Formalize subprocessor review as a standing step in AI vendor onboarding, not a one-time check. - Turn your informal data flow knowledge into a maintained, reviewed document. - Negotiate explicit, contractual retention terms rather than relying on a vendor's default policy. - Run a tabletop exercise: could you answer a customer's residency question within 24 hours today? #### Managed exposure, tighten the remaining edges **Min:** 55 **Max:** 79 **Verdict:** Your highest-risk workloads are reasonably controlled and documented. The remaining gaps are usually around evidence production speed and flow-down enforcement for newer AI vendors that have not yet been through the same rigor as your established systems. **Recommendations:** - Automate residency and retention evidence generation so it does not depend on manual reconstruction. - Extend flow-down assessment to every AI vendor added in the last twelve months, not just the original set. - Review whether fine-tuning or embedding pipelines create new data flows your original map did not anticipate. - Add AI data sovereignty as a standing line item in your annual compliance review cycle. - Confirm key custody arrangements survive a vendor's infrastructure or ownership change. #### Defensible sovereignty posture **Min:** 80 **Max:** 100 **Verdict:** You can currently demonstrate where AI data lives, who holds the keys, and who can reach it, with evidence you can produce quickly. That posture is a genuine competitive advantage in regulated procurement, where sovereignty questions increasingly appear in RFPs before pricing does. **Recommendations:** - Keep the data flow map current as an explicit gate in your AI system change management process. - Use your sovereignty posture as a differentiator in customer and prime contractor conversations. - Periodically re-verify subprocessor lists; vendors change infrastructure providers more often than contracts get renegotiated. - Extend the same rigor to any new agentic or tool-calling AI systems that create new data flows. - Share your evidence-production process across the organization so it survives staff turnover. ## Content **Intro:** This free AI data sovereignty risk assessment scores your organization across eight dimensions that determine where AI data actually goes, not where a vendor's marketing page says it goes. It is built for IT directors, compliance leads, and security architects at manufacturers who handle export-controlled technical data, customer-confidential designs, or personal data inside AI workflows. Answer eight questions covering inference location, encryption key custody, subprocessor visibility, retention, and audit evidence, and get a scored risk band with prioritized recommendations. Most organizations discover the gap is not malicious, it is that nobody ever mapped where a public AI API actually routes a request once it leaves the browser. **Sections:** #### Why data sovereignty breaks quietly **Body:** A sovereignty failure rarely looks dramatic. It looks like an engineer pasting a drawing into a chat tool that routes through three subprocessors across two continents, a vendor rotating encryption keys during an infrastructure migration nobody was told about, or a retention policy that defaults to indefinite unless someone finds the opt-out checkbox. None of this triggers an alert. It surfaces months later, during a customer audit, a proposal review, or an incident investigation, when someone finally asks the question a contract required you to already know the answer to. **Bullets:** - Cloud AI APIs frequently load-balance requests across regions for latency, even when the marketing page names a single region. - Subprocessor lists change as vendors adopt new infrastructure partners, often without a proactive customer notice. - Encryption key custody determines who can technically read your data, independent of where the data physically sits. - Retention defaults in consumer and prosumer AI tools are usually far longer than teams assume. #### The eight risks this assessment measures **Body:** Each question maps to a control that shows up in real audits: inference location, subprocessor transparency, key custody, cross-border transfer, data flow documentation, retention policy, contractual flow-down enforcement, and evidence production speed. These are not abstract compliance categories. They are the exact questions a defense prime's supplier security team, a customer's procurement counsel, or a CMMC assessor will ask when they learn AI touches your workflow, and the exact questions that determine whether an incident stays a contained internal matter or becomes a reportable breach. #### How to read your score **Body:** A low score does not mean your AI program is reckless, it usually means sovereignty was never assigned as anyone's explicit responsibility while the program grew organically from a few pilots into production use. Treat the band verdict as a starting priority list rather than a grade. The fastest wins are almost always encryption key custody and data flow mapping, because both are entirely within your control regardless of which AI vendor you use, while subprocessor restrictions require contract renegotiation and take longer to close. #### How Netray builds sovereign AI deployments **Body:** Netray designs on-prem and private AI infrastructure for aerospace, defense, and electronics manufacturers where data sovereignty is not negotiable. We deploy open-weight models entirely inside your network boundary, put encryption keys in infrastructure you control, and build the data flow documentation your customers and assessors will actually ask to see. For customers who need a hybrid posture, we help you draw the line precisely between what can safely leave the building and what cannot, backed by a defensible architecture rather than a hopeful assumption. **Cta:** Get a data flow map and sovereignty gap analysis for every AI system currently touching your sensitive data. **Faq:** #### Is running AI entirely on-prem the only way to guarantee data sovereignty? **Answer:** It is the strongest guarantee, but not the only workable path. A contracted private cloud instance with customer-managed keys, restricted subprocessors, and enforced regional pinning can satisfy many sovereignty requirements. The right answer depends on your specific obligations: ITAR and classified work typically require full on-prem or air-gapped deployment, while general data residency clauses can often be satisfied with a well-contracted private cloud arrangement. #### How do I find out what subprocessors an AI vendor actually uses? **Answer:** Request their current subprocessor list directly, usually published as a data processing addendum exhibit or available on request from their trust or security page. Review it against your own restricted-country list and any customer flow-down clauses. Ask specifically whether the subprocessor list can change without prior notice, since many vendor contracts reserve that right, which quietly reopens a sovereignty question you thought you had closed. #### Does customer-managed encryption actually stop a cloud vendor from reading my data? **Answer:** It removes the vendor's ability to decrypt data at rest without your explicit key release, which closes a real risk around vendor staff access, subpoenas served on the vendor, and infrastructure compromise on their side. It does not protect data while the model is actively processing it in memory, which is why workload isolation and access logging around the compute layer still matter alongside key custody. #### What is the fastest way to improve a low sovereignty score? **Answer:** Start with the two controls entirely within your reach: build a data flow map for every AI system in production, and move encryption key custody for your most sensitive workload to keys you control. Both can typically be done in two to four weeks without vendor contract changes. Subprocessor restrictions and retention renegotiation take longer because they require the vendor's cooperation, so start those conversations in parallel rather than sequentially. ## Search terms AI data sovereignty assessment, data residency AI risk, cross-border AI data flow, AI encryption key custody, sovereign AI compliance, on-prem AI data sovereignty, AI subprocessor risk, data residency LLM --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json